phanalist

E0046: Input-Controlled Cardinality

E0046 reports request-controlled values that reach loops, allocation sinks, or callees without a bound. Cardinality is separate from taint: a value may be tainted without controlling collection size, and an input-controlled collection may contain ordinary strings.

What it checks

• Superglobals $_GET, $_POST, $_REQUEST, $_COOKIE, and $_FILES
• Request-relevant $_SERVER keys such as HTTP_*, REQUEST_*, PHP_AUTH_*, QUERY_STRING, and PATH_INFO; iterating the whole $_SERVER array is treated as server metadata
• $argv when include_cli_input is enabled
• Results of filter_input(), apache_request_headers(), and getallheaders()
• readline() when include_cli_input is enabled
• file_get_contents('php://input')
• Heuristic request accessors named input, query, post, get, all, json, file, cookie, header, or param
• Request-controlled values used as loop bounds
• Request-controlled values passed to allocation sinks such as str_repeat(), range(), array_fill(), array_pad(), str_split(), explode(), and preg_split()
• Request-controlled arguments passed to local functions or methods whose resource summary iterates or allocates in proportion to that argument

E0046 findings identify the source, such as $_GET or php://input, and the sink. They do not claim that the input is malicious; they identify a missing bound or validation step.

Model limits

Input cardinality is tracked with a conservative taint-and-size model, not with full PHP type inference. The following can cause missed or additional findings:

• Values transformed through helpers without a resource summary lose their cardinality information
• Arrays selected by dynamic keys are treated as unknown-sized input collections when the base array is request-controlled
• A loop bound capped by a comparison guard is treated as bounded on that path; guards in unrelated branches are not applied
• Validation through custom code is not recognized unless it establishes a recognized cap
• Request accessors are recognized by name, so a non-request method with one of the listed names may be treated as a source
• Input read through custom stream wrappers, database results, or message queues is not tracked
• CLI input is disabled by default; set include_cli_input: true when the application processes command-line arguments
• Environment variables and whole-array $_SERVER iteration are treated as trusted server metadata, not request cardinality
• Recursive and higher-order data flow is summarized conservatively

Configuration

rules:
  E0046:
    runtime_threshold: quadratic
    heap_alloc_threshold: quadratic
    retained_element_bytes: 32
    report_input_cardinality: true
    include_cli_input: false
    max_findings_per_function: 20

Set report_input_cardinality: false to suppress E0046 findings while keeping E0044 and E0045 active. max_findings_per_function limits duplicate findings in one function body.

This site is open source. Improve this page.